X-Git-Url: https://git.exim.org/users/heiko/exim.git/blobdiff_plain/2ddb4094c1b6861bebe191fa1466f53399e1e6d9..039f131577938145fb859309a9822fdce90d7155:/doc/doc-txt/ChangeLog diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index e4d1719ec..d56454ccc 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -1,10 +1,570 @@ -Change log file for Exim from version 4.21 ------------------------------------------- This document describes *changes* to previous versions, that might affect Exim's operation, with an unchanged configuration file. For new options, and new features, see the NewStuff file next to this ChangeLog. +Exim version 4.95 +----------------- + +JH/01 Bug 1329: Fix format of Maildir-format filenames to match other mail- + related applications. Previously an "H" was used where available info + says that "M" should be, so change to match. + +JH/02 Bug 2587: Fix pam expansion condition. Tainted values are commonly used + as arguments, so an implementation trying to copy these into a local + buffer was taking a taint-enforcement trap. Fix by using dynamically + created buffers. Similar fix for radius expansion condition. + +JH/03 Bug 2586: Fix listcount expansion operator. Using tainted arguments is + reasonable, eg. to count headers. Fix by using dynamically created + buffers rather than a local. Do similar fixes for ACL actions "dcc", + "log_reject_target", "malware" and "spam"; the arguments are expanded + so could be handling tainted values. + +JH/04 Bug 2590: Fix -bi (newaliases). A previous code rearrangement had + broken the (no-op) support for this sendmail command. Restore it + to doing nothing, silently, and returning good status. + +JH/05 Bug 2593: Fix "vacation" in Exim filter. Previously, when a "once" + record path was given (or the default used) without a leading directory + path, an error occurred on trying to open it. Use the transport's working + directory. + +JH/06 Bug 2594: Change the name used for certificate name checks in the smtp + transport. Previously it was the name on the DNS A-record; use instead + the head of the CNAME chain leading there (if there is one). This seems + to align better with RFC 6125. + +JH/07 Bug 2597: Fix a resource leak. Using a lookup in obtaining a value for + smtp_accept_max_per_host allocated resources which were not released + when the limit was exceeded. This eventually crashed the daemon. Fix + by adding a relase action in that path. + +JH/08 Bug 2598: Fix verify ACL condition. The options for the condition are + expanded; previously using tainted values was rejected. Fix by using + dynamically-created buffers. + +JH/09 Relax restrictions on ACL verify condition needing access to message + headers. Previously they were only permitted in data and non-smtp ACLs; + permit also mime, dkim, prdr quit and notquit. Applies to header-syntax, + not_blind, header_sender and header_names_ascii verification. + +JH/10 Bug 2603: Fix coding of string copying to only evaluate arguments once. + Previously a macro used one argument twice; when called with the + argument as an expression having side-effects, incorrect operation + resulted. Use an inlineable function. + +JH/11 Bug 2604: Fix request to cutthrough-deliver when a connection is already + held open for a verify callout. Previously this wan not accounted for + and a corrupt onward SMTP conversation resulted. + +JH/12 Bug 2607: Fix the ${srs_encode } expansion to handle quoted local_parts. + Previously they were embedded naively in the constructed address; when + needed, strip the quoting and quote the entire local_part. + Also make the inbound_srs expansion condition handle quoting. + +JH/13 Fix dsearch "subdir" filter to ignore ".". Previously only ".." was + excluded, not matching the documentation. + +JH/14 Bug 2606: Fix a segfault in sqlite lookups. When no, or a bad, filename + was given for the sqlite_dbfile a trap resulted. + +JH/15 Bug 2620: Fix "spam" ACL condition. Previously, tainted values for the + "name" argument resulted in a trap. There is no reason to disallow such; + this was a coding error. + +JH/16 Bug 2615: Fix pause during message reception, on systems that have been + suspended/resumed. The Linux CLOCK_MONOTONIC does not account for time + spent suspended, ignoring the Posix definition. Previously we assumed + it did and a constant offset from real time could be used as a correction. + Change to using the same clock source for the start-of-message and the + post-message next-tick-wait. Also change to using CLOCK_BOOTTIME if it + exists, just to get a clock slightly more aligned to reality. + +JH/17 Bug 2295: Fix DKIM signing to always semicolon-terminate. Although the + RFC says it is optional some validators care. The missing char was not + intended but triggered by a line-wrap alignement. Discovery and fix by + Guillaume Outters, hacked on by JH. + +JH/18 Bug 2617: Fix a taint trap in parse_fix_phrase(). Previously when the + name being quoted was tainted a trap would be taken. Fix by using + dynamicaly created buffers. The routine could have been called by a + rewrite with the "h" flag, by using the "-F" command-line option, or + by using a "name=" option on a control=submission ACL modifier. + +JH/19 SPF: change the Authentication-Results expansion component to give + smtp.helo when the sender domain is empty. Previously it gave + "smtp.mailfrom=<>" + +JH/20 Bug 2631: ACL dnslist conditions now ignore and log any lookups returns + not in 127.0.0.0/8 to help in spotting list domains taken over by a + domain-parking registrar. + +JH/21 Bug 2630: Fix eol-replacement string for the ${readsocket } expansion. + Previously when a whitespace character was specified it was not inserted + after removing the newline. + +JH/22 Bug 2265: Force SNI usage for smtp transport DANE'd connections, to be + the domain part of the recipient address. This overrides any tls_sni + option set, which was previously used. + +JH/23 Logging: with the +tls_sni log_selector, do not wrap the received SNI + in quotes. + +JH/24 Bug 2634: Fix a taint trap seen on NetBSD: the testing coded for + is_tainted() had an off-by-one error in the overenthusiastic direction. + Find and fix by Gavan. Although NetBSD is not a supported platform for + 4.94 this bug could affect other platforms. + +PP/01 Fix default prime selection to be consistent. + One path used ike23 still, instead of exim.dev.20160529.3; now both + execution flows will use the same DH primes (currently + exim.dev.20160529.3). + +JH/25 OpenSSL: Fix back-compatibility behaviour surrounding tls_certificates + option in smtp transport, to match the documentation. Previously + verification was not being done in some cases where it should have been. + +JH/26 Bug 2646: fix a memory usage issue in ldap lookups. Previously, when more + than one server was defined and depending on the platform memory layout + details, an internal consistency trap could be hit while walking the list + of servers. + +JH/27 Bug 2648: fix the passing of an authenticator public-name through spool + files. The value is used by the authresults expansion item. Previously + if this was used in a router or transport, a crash could result. + +JH/28 Fix spurious logging of select error. Some platforms, notably FreeBSD, + have a sufficient incidence of EINTR returns from select that an + interaction with other operations done by the main daemon loop exposed + a bug in the error-handling. This was benign apart from the log + messages. + + +Exim version 4.94 +----------------- + +JH/01 Avoid costly startup code when not strictly needed. This reduces time + for some exim process initialisations. It does mean that the logging + of TLS configuration problems is only done for the daemon startup. + +JH/02 Early-pipelining support code is now included unless disabled in Makefile. + +JH/03 DKIM verification defaults no long accept sha1 hashes, to conform to + RFC 8301. They can still be enabled, using the dkim_verify_hashes main + option. + +JH/04 Support CHUNKING from an smtp transport using a transport_filter, when + DKIM signing is being done. Previously a transport_filter would always + disable CHUNKING, falling back to traditional DATA. + +JH/05 Regard command-line recipients as tainted. + +JH/06 Bug 340: Remove the daemon pid file on exit, when due to SIGTERM. + +JH/07 Bug 2489: Fix crash in the "pam" expansion condition. It seems that the + PAM library frees one of the arguments given to it, despite the + documentation. Therefore a plain malloc must be used. + +JH/08 Bug 2491: Use tainted buffers for the transport smtp context. Previously + on-stack buffers were used, resulting in a taint trap when DSN information + copied from a received message was written into the buffer. + +JH/09 Bug 2493: Harden ARC verify against Outlook, whick has been seen to mix + the ordering of its ARC headers. This caused a crash. + +JH/10 Bug 2492: Use tainted memory for retry record when needed. Previously when + a new record was being constructed with information from the peer, a trap + was taken. + +JH/11 Bug 2494: Unset the default for dmarc_tld_file. Previously a naiive + installation would get error messages from DMARC verify, when it hit the + nonexistent file indicated by the default. Distros wanting DMARC enabled + should both provide the file and set the option. + Also enforce no DMARC verification for command-line sourced messages. + +JH/12 Fix an uninitialised flag in early-pipelining. Previously connections + could, depending on the platform, hang at the STARTTLS response. + +JH/13 Bug 2498: Reset a counter used for ARC verify before handling another + message on a connection. Previously if one message had ARC headers and + the following one did not, a crash could result when adding an + Authentication-Results: header. + +JH/14 Bug 2500: Rewind some of the common-coding in string handling between the + Exim main code and Exim-related utities. The introduction of taint + tracking also did many adjustments to string handling. Since then, eximon + frequently terminated with an assert failure. + +JH/15 When PIPELINING, synch after every hundred or so RCPT commands sent and + check for 452 responses. This slightly helps the inefficieny of doing + a large alias-expansion into a recipient-limited target. The max_rcpt + transport option still applies (and at the current default, will override + the new feature). The check is done for either cause of synch, and forces + a fast-retry of all 452'd recipients using a new MAIL FROM on the same + connection. The new facility is not tunable at this time. + +JH/16 Fix the variables set by the gsasl authenticator. Previously a pointer to + library live data was being used, so the results became garbage. Make + copies while it is still usable. + +JH/17 Logging: when the deliver_time selector ise set, include the DT= field + on delivery deferred (==) and failed (**) lines (if a delivery was + attemtped). Previously it was only on completion (=>) lines. + +JH/18 Authentication: the gsasl driver not provides the $authN variables in time + for the expansion of the server_scram_iter and server_scram_salt options. + +WB/01 SPF: DNS lookups for the obsolete SPF RR type done by the libspf2 library + are now specifically given a NO_DATA response without hitting the system + resolver. The library goes on to do the now-standard TXT lookup. + Use of dnsdb lookups is not affected. + +JH/19 Bug 2507: Modules: on handling a dynamic-module (lookups) open failure, + only retrieve the errormessage once. Previously two calls to dlerror() + were used, and the second one (for mainlog/paniclog) retrieved null + information. + +JH/20 Taint checking: disallow use of tainted data for + - the appendfile transport file and directory options + - the pipe transport command + - the autoreply transport file, log and once options + - file names used by the redirect router (including filter files) + - named-queue names + - paths used by single-key lookups + Previously this was permitted. + +JH/21 Bug 2501: Fix init call in the heimdal authenticator. Previously it + adjusted the size of a major service buffer; this failed because the + buffer was in use at the time. Change to a compile-time increase in the + buffer size, when this authenticator is compiled into exim. + +JH/22 Taint-checking: move to safe-mode taint checking on all platforms. The + previous fast-mode was untenable in the face of glibs using mmap to + support larger malloc requests. + +PP/01 Update the openssl_options possible values through OpenSSL 1.1.1c. + New values supported, if defined on system where compiled: + allow_no_dhe_kex, cryptopro_tlsext_bug, enable_middlebox_compat, + no_anti_replay, no_encrypt_then_mac, prioritize_chacha, tlsext_padding + +JH/23 Performance improvement in the initial phase of a two-pass queue run. By + running a limited number of proceses in parallel, a benefit is gained. The + amount varies with the platform hardware and load. The use of the option + queue_run_in_order means we cannot do this, as ordering becomes + indeterminate. + +JH/24 Bug 2524: fix the cyrus_sasl auth driver gssapi usage. A previous fix + had introduced a string-copy (for ensuring NUL-termination) which was not + appropriate for that case, which can include embedded NUL bytes in the + block of data. Investigation showed the copy to actually be needless, the + data being length-specified. + +JH/25 Fix use of concurrent TLS connections under GnuTLS. When a callout was + done during a receiving connection, and both used TLS, global info was + used rather than per-connection info for tracking the state of data + queued for transmission. This could result in a connection hang. + +JH/26 Fix use of the SIZE parameter on MAIL commands, on continued connections. + Previously, when delivering serveral messages down a single connection + only the first would provide a SIZE. This was due to the size information + not being properly tracked. + +JH/27 Bug 2530: When operating in a timezone with sub-minute offset, such as + TAI (at 37 seconds currently), pretend to be in UTC for time-related + expansion and logging. Previously, spurious values such as a future + minute could be seen. + +JH/28 Bug 2533: Fix expansion of ${tr } item. When called in some situations + it could crash from a null-deref. This could also affect the + ${addresses: } operator and ${readsock } item. + +JH/29 Bug 2537: Fix $mime_part_count. When a single connection had a non-mime + message following a mime one, the variable was not reset. + +JH/30 When an pipelined-connect fails at the first response, assume incorrect + cached capability (perhaps the peer reneged?) and immediately retry in + non-pipelined mode. + +JH/31 Fix spurious detection of timeout while writing to transport filter. + +JH/32 Bug 2541: Fix segfault on bad cmdline -f (sender) argument. Previously + an attempt to copy the string was made before checking it. + +JH/33 Fix the dsearch lookup to return an untainted result. Previously the + taint of the lookup key was maintained; we now regard the presence in the + filesystem as sufficient validation. + +JH/34 Fix the readsocket expansion to not segfault when an empty "options" + argument is supplied. + +JH/35 The dsearch lookup now requires that the directory is an absolute path. + Previously this was not checked, and nonempty relative paths made an + access under Exim's current working directory. + +JH/36 Bug 2554: Fix msg:defer event for the hosts_max_try_hardlimit case. + Previously no event was raised. + +JH/37 Bug 2552: Fix the check on spool space during reception to use the SIZE + parameter supplied by the sender MAIL FROM command. Previously it was + ignored, and only the check_spool_space option value for the required + leeway checked. + +JH/38 Fix $dkim_key_length. This should, after a DKIM verification, present + the size of the signing public-key. Previously it was instead giving + the size of the signature hash. + +JH/39 DKIM verification: the RFC 8301 restriction on sizes of RSA keys is now + the default. See the (new) dkim_verify_min_keysizes option. + +JH/40 Fix a memory-handling bug: when a connection carried multiple messages + and an ACL use a lookup for checking either the local_part or domain, + stale data could be accessed. Ensure that variable references are + dropped between messages. + +JH/41 Bug 2571: Fix SPA authenticator. Running as a server, an offset supplied + by the client was not checked as pointing within response data before + being used. A malicious client could thus cause an out-of-bounds read and + possibly gain authentication. Fix by adding the check. + +JH/42 Internationalisation: change the default for downconversion in the smtp + transport to be "if needed". Previously it was "as previously set" for + the message, which usually meant "if needed" for message-submission but + "no" for everything else. However, MTAs have been seen using SMTPUTF8 + even when the envelope addresses did not need it, resulting in forwarding + failures to non-supporting MTAs. A downconvert in such cases will be + a no-op on the addresses, merely dropping the use of SMTPUTF8 by the + transport. The change does mean that addresses needing conversion will + be converted when previously a delivery failure would occur. + +JH/43 Fix possible long line in DSN. Previously when a very long SMTP error + response was received it would be used unchecked in a fail-DSN, violating + standards on line-length limits. Truncate if needed. + +HS/01 Remove parameters of the link to www.open-spf.org. The linked form + doesn't work. (Additionally add a new main config option to configure the + spf_smtp_comment) + + +Exim version 4.93 +----------------- + +JH/01 OpenSSL: With debug enabled output keying information sufficient, server + side, to decode a TLS 1.3 packet capture. + +JH/02 OpenSSL: Suppress the sending of (stateful) TLS1.3 session tickets. + Previously the default library behaviour applied, sending two, each in + its own TCP segment. + +JH/03 Debug output for ACL now gives the config file name and line number for + each verb. + +JH/04 The default received_header_text now uses the RFC 8314 tls cipher clause. + +JH/05 DKIM: ensure that dkim_domain elements are lowercased before use. + +JH/06 Fix buggy handling of autoreply bounce_return_size_limit, and a possible + buffer overrun for (non-chunking) other transports. + +JH/07 GnuTLS: Our use of late (post-handshake) certificate verification, under + TLS1.3, means that a server rejecting a client certificate is not visible + to the client until the first read of encrypted data (typically the + response to EHLO). Add detection for that case and treat it as a failed + TLS connection attempt, so that the normal retry-in-clear can work (if + suitably configured). + +JB/01 Bug 2375: fix expansions of 822 addresses having comments in local-part + and/or domain. Found and fixed by Jason Betts. + +JH/08 Add hardening against SRV & TLSA lookups the hit CNAMEs (a nonvalid + configuration). If a CNAME target was not a wellformed name pattern, a + crash could result. + +JH/09 Logging: Fix initial listening-on line for multiple ports for an IP when + the OS reports them interleaved with other addresses. + +JH/10 OpenSSL: Fix aggregation of messages. Previously, when PIPELINING was + used both for input and for a verify callout, both encrypted, SMTP + responses being sent by the server could be lost. This resulted in + dropped connections and sometimes bounces generated by a peer sending + to this system. + +JH/11 Harden plaintext authenticator against a badly misconfigured client-send + string. Previously it was possible to cause undefined behaviour in a + library routine (usually a crash). Found by "zerons". + +JH/12 Bug 2384: fix "-bP smtp_receive_timeout". Previously it returned no + output. + +JH/13 Bug 2386: Fix builds with Dane under LibreSSL 2.9.0 onward. Some old + API was removed, so update to use the newer ones. + +JH/14 Bug 1891: Close the log file if receiving a non-smtp message, without + any timeout set, is taking a long time. Previously we would hang on to a + rotated logfile "forever" if the input was arriving with long gaps + (a previous attempt to fix addressed lack, for a long time, of initial + input). + +HS/01 Bug 2390: Use message_id for tempfile creation to avoid races in a + shared (NFS) environment. The length of the tempfile name is now + 4 + 16 ("hdr.$message_exim_id") which might break on file + systems which restrict the file name length to lower values. + (It was "hdr.$pid".) + +HS/02 Bug 2390: Use message_id for tempfile creation to avoid races in a + shared (NFS) environment. + +HS/03 Bug 2392: exigrep does case sensitive *option* processing (as it + did for all versions <4.90). Notably -M, -m, --invert, -I may be + affected. + +JH/15 Use unsigned when creating bitmasks in macros, to avoid build errors + on some platforms for bit 31. + +JH/16 GnuTLS: rework ciphersuite strings under recent library versions. Thanks + to changes apparently associated with TLS1.3 handling some of the APIs + previously used were either nonfunctional or inappropriate. Strings + like TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM__AEAD:256 + and TLS1.2:ECDHE_SECP256R1__RSA_SHA256__AES_128_CBC__SHA256:128 replace + the previous TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256 . + This affects log line X= elements, the $tls_{in,out}_cipher variables, + and the use of specific cipher names in the encrypted= ACL condition. + +JH/17 OpenSSL: the default openssl_options now disables ssl_v3. + +JH/18 GnuTLS: fix $tls_out_ocsp under hosts_request_ocsp. Previously the + verification result was not updated unless hosts_require_ocsp applied. + +JH/19 Bug 2398: fix listing of a named-queue. Previously, even with the option + queue_list_requires_admin set to false, non-admin users were denied the + facility. + +JH/20 Bug 2389: fix server advertising of usable certificates, under GnuTLS in + directory-of-certs mode. Previously they were advertised despite the + documentation. + +JH/21 The smtp transport option "hosts_noproxy_tls" is now unset by default. + A single TCP connection by a client will now hold a TLS connection open + for multiple message deliveries, by default. Previously the default was to + not do so. + +JH/22 The smtp transport option "hosts_try_dane" now enables all hosts by + default. If built with the facility, DANE will be used. The facility + SUPPORT_DANE is now enabled in the prototype build Makefile "EDITME". + +JH/23 The build default is now for TLS to be included; the SUPPORT_TLS define + is replaced with DISABLE_TLS. Either USE_GNUTLS or (the new) USE_OPENSSL + must be defined and you must still, unless you define DISABLE_TLS, manage + the the include-dir and library-file requirements that go with that + choice. Non-TLS builds are still supported. + +JH/24 Fix duplicated logging of peer name/address, on a transport connection- + reject under TFO. + +JH/25 The smtp transport option "hosts_try_fastopen" now enables all hosts by + default. If the platform supports and has the facility enabled, it will + be requested on all coneections. + +JH/26 The PIPE_CONNECT facility is promoted from experimental status and is now + controlled by the build-time option SUPPORT_PIPE_CONNECT. + +PP/01 Unbreak heimdal_gssapi, broken in 4.92. + +JH/27 Bug 2404: Use the main-section configuration option "dsn_from" for + success-DSN messages. Previously the From: header was always the default + one for these; the option was ignored. + +JH/28 Fix the timeout on smtp response to apply to the whole response. + Previously it was reset for every read, so a teergrubing peer sending + single bytes within the time limit could extend the connection for a + long time. Credit to Qualsys Security Advisory Team for the discovery. + +JH/29 Fix DSN Final-Recipient: field. Previously it was the post-routing + delivery address, which leaked information of the results of local + forwarding. Change to the original envelope recipient address, per + standards. + +JH/30 Bug 2411: Fix DSN generation when RFC 3461 failure notification is + requested. Previously not bounce was generated and a log entry of + error ignored was made. + +JH/31 Avoid re-expansion in ${sort } expansion. (CVE-2019-13917) + +JH/32 Introduce a general tainting mechanism for values read from the input + channel, and values derived from them. Refuse to expand any tainted + values, to catch one form of exploit. + +JH/33 Bug 2413: Fix dkim_strict option. Previously the expansion result + was unused and the unexpanded text used for the test. Found and + fixed by Ruben Jenster. + +JH/34 Fix crash after TLS shutdown. When the TCP/SMTP channel was left open, + an attempt to use a TLS library read routine dereffed a nul pointer, + causing a segfault. + +JH/35 Bug 2409: filter out-of-spec chars from callout response before using + them in our smtp response. + +JH/36 Have the general router option retry_use_local_part default to true when + any of the restrictive preconditions are set (to anything). Previously it + was only for check_local user. The change removes one item of manual + configuration which is required for proper retries when a remote router + handles a subset of addresses for a domain. + +JH/37 Appendfile: when evaluating quota use (non-quota_size_regex) take the file + link count into consideration. + +HS/04 Fix handling of very log lines in -H files. If a - line + caused the extension of big_buffer, the following lines were ignored. + +JH/38 Bug 1395: Teach the DNS negative-cache about TTL value from the SOA in + accordance with RFC 2308. Previously there was no expiry, so a longlived + receive process (eg. due to ACL delays) versus a short SOA value could + surprise. + +HS/05 Handle trailing backslash gracefully. (CVE-2019-15846) + +JH/39 Promote DMARC support to mainline. + +JH/40 Bug 2452: Add a References: header to DSNs. + +JH/41 With GnuTLS 3.6.0 (and later) do not attempt to manage Diffie-Hellman + parameters. The relevant library call is documented as "Deprecated: This + function is unnecessary and discouraged on GnuTLS 3.6.0 or later. Since + 3.6.0, DH parameters are negotiated following RFC7919." + +HS/06 Change the default of dnssec_request_domains to "*" + +JH/42 Bug 2545: Fix CHUNKING for all RCPT commands rejected. Previously we + carried on and emitted a BDAT command, even when PIPELINING was not + active. + +JH/43 Bug 2465: Fix taint-handling in dsearch lookup. Previously a nontainted + buffer was used for the filename, resulting in a trap when tainted + arguments (eg. $domain) were used. + +JH/44 With OpenSSL 1.1.1 (onwards) disable renegotiation for TLS1.2 and below; + recommended to avoid a possible server-load attack. The feature can be + re-enabled via the openssl_options main cofiguration option. + +JH/45 local_scan API: documented the current smtp_printf() call. This changed + for version 4.90 - adding a "more data" boolean to the arguments. + Bumped the ABI version number also, this having been missed previously; + release versions 4.90 to 4.92.3 inclusive were effectively broken in + respect of usage of smtp_printf() by either local_scan code or libraries + accessed via the ${dlfunc } expansion item. Both will need coding + adjustment for any calls to smtp_printf() to match the new function + signature; a FALSE value for the new argument is always safe. + +JH/46 FreeBSD: fix use of the sendfile() syscall. The shim was not updating + the file-offset (which the Linux syscall does, and exim expects); this + resulted in an indefinite loop. + +JH/47 ARC: fix crash in signing, triggered when a configuration error failed + to do ARC verification. The Authentication-Results: header line added + by the configuration then had no ARC item. + + Exim version 4.92 ----------------- @@ -43,6 +603,157 @@ JH/06 Bug 2275: The MIME ACL unlocked the received message files early, and JH/07 Bug 177: Make a random-recipient callout success visible in ACL, by setting $sender_verify_failure/$recipient_verify_failure to "random". +JH/08 When generating a selfsigned cert, use serial number 1 since zero is not + legitimate. + +JH/09 Bug 2274: Fix logging of cmdline args when starting in an unlinked cwd. + Previously this would segfault. + +JH/10 Fix ARC signing for case when DKIM signing failed. Previously this would + segfault. + +JH/11 Bug 2264: Exim now only follows CNAME chains one step by default. We'd + like zero, since the resolver should be doing this for us, But we need one + as a CNAME but no MX presence gets the CNAME returned; we need to check + that doesn't point to an MX to declare it "no MX returned" rather than + "error, loop". A new main option is added so the older capability of + following some limited number of chain links is maintained. + +JH/12 Add client-ip info to non-pass iprev ${authres } lines. + +JH/13 For receent Openssl versions (1.1 onward) use modern generic protocol + methods. These should support TLS 1.3; they arrived with TLS 1.3 and the + now-deprecated earlier definitions used only specified the range up to TLS + 1.2 (in the older-version library docs). + +JH/14 Bug 2284: Fix DKIM signing for body lines starting with a pair of dots. + +JH/15 Rework TLS client-side context management. Stop using a global, and + explicitly pass a context around. This enables future use of TLS for + connections to service-daemons (eg. malware scanning) while a client smtp + connection is using TLS; with cutthrough connections this is quite likely. + +JH/16 Fix ARC verification to do AS checks in reverse order. + +JH/17 Support a "tls" option on the ${readsocket } expansion item. + +JH/18 Bug 2287: Fix the protocol name (eg utf8esmtp) for multiple messages + using the SMTPUTF8 option on their MAIL FROM commands, in one connection. + Previously the "utf8" would be re-prepended for every additional message. + +JH/19 Reject MAIL FROM commands with SMTPUTF8 when the facility was not advertised. + Previously thery were accepted, resulting in issues when attempting to + forward messages to a non-supporting MTA. + +PP/02 Let -n work with printing macros too, not just options. + +JH/20 Bug 2296: Fix cutthrough for >1 address redirection. Previously only + one parent address was copied, and bogus data was used at delivery-logging + time. Either a crash (after delivery) or bogus log data could result. + Discovery and analysis by Tim Stewart. + +PP/03 Make ${utf8clean:} expansion operator detect incomplete final character. + Previously if the string ended mid-character, we did not insert the + promised '?' replacement. + +PP/04 Documentation: current string operators work on bytes, not codepoints. + +JH/21 Change as many as possible of the global flags into one-bit bitfields; these + should pack well giving a smaller memory footprint so better caching and + therefore performance. Group the declarations where this can't be done so + that the byte-sized flag variables are not interspersed among pointer + variables, giving a better chance of good packing by the compiler. + +JH/22 Bug 1896: Fix the envelope from for DMARC forensic reports to be possibly + non-null, to avoid issues with sites running BATV. Previously reports were + sent with an empty envelope sender so looked like bounces. + +JH/23 Bug 2318: Fix the noerror command within filters. It wasn't working. + The ignore_error flag wasn't being returned from the filter subprocess so + was not set for later routers. Investigation and fix by Matthias Kurz. + +JH/24 Bug 2310: Raise a msg:fail:internal event for each undelivered recipient, + and a msg:complete for the whole, when a message is manually removed using + -Mrm. Developement by Matthias Kurz, hacked on by JH. + +JH/25 Avoid fixed-size buffers for pathnames in DB access. This required using + a "Gnu special" function, asprintf() in the DB utility binary builds; I + hope that is portable enough. + +JH/26 Bug 2311: Fix DANE-TA verification under GnuTLS. Previously it was also + requiring a known-CA anchor certificate; make it now rely entirely on the + TLSA as an anchor. Checking the name on the leaf cert against the name + on the A-record for the host is still done for TA (but not for EE mode). + +JH/27 Fix logging of proxy address. Previously, a pointless "PRX=[]:0" would be + included in delivery lines for non-proxied connections, when compiled with + SUPPORT_SOCKS and running with proxy logging enabled. + +JH/28 Bug 2314: Fire msg:fail:delivery event even when error is being ignored. + Developement by Matthias Kurz, tweaked by JH. While in that bit of code, + move the existing event to fire before the normal logging of message + failure so that custom logging is bracketed by normal logging. + +JH/29 Bug 2322: A "fail" command in a non-system filter (file) now fires the + msg:fail:internal event. Developement by Matthias Kurz. + +JH/30 Bug 2329: Increase buffer size used for dns lookup from 2k, which was + far too small for todays use of crypto signatures stored there. Go all + the way to the max DNS message size of 64kB, even though this might be + overmuch for IOT constrained device use. + +JH/31 Fix a bad use of a copy function, which could be used to pointlessly + copy a string over itself. The library routine is documented as not + supporting overlapping copies, and on MacOS it actually raised a SIGABRT. + +JH/32 For main options check_spool_space and check_inode_space, where the + platform supports 64b integers, support more than the previous 2^31 kB + (i.e. more than 2 TB). Accept E, P and T multipliers in addition to + the previous G, M, k. + +JH/33 Bug 2338: Fix the cyrus-sasl authenticator to fill in the + $authenticated_fail_id variable on authentication failure. Previously + it was unset. + +JH/34 Increase RSA keysize of autogen selfsign cert from 1024 to 2048. RHEL 8.0 + OpenSSL didn't want to use such a weak key. Do for GnuTLS also, and for + more-modern GnuTLS move from GNUTLS_SEC_PARAM_LOW to + GNUTLS_SEC_PARAM_MEDIUM. + +JH/35 OpenSSL: fail the handshake when SNI processing hits a problem, server + side. Previously we would continue as if no SNI had been received. + +JH/36 Harden the handling of string-lists. When a list consisted of a sole + "<" character, which should be a list-separator specification, we walked + off past the nul-terimation. + +JH/37 Bug 2341: Send "message delayed" warning MDNs (restricted to external + causes) even when the retry time is not yet met. Previously they were + not, meaning that when (say) an account was over-quota and temp-rejecting, + and multiple senders' messages were queued, only one sender would get + notified on each configured delay_warning cycle. + +JH/38 Bug 2351: Log failures to extract envelope addresses from message headers. + +JH/39 OpenSSL: clear the error stack after an SSL_accept(). With anon-auth + cipher-suites, an error can be left on the stack even for a succeeding + accept; this results in impossible error messages when a later operation + actually does fail. + +AM/01 Bug 2359: GnuTLS: repeat lowlevel read and write operations while they + return error codes indicating retry. Under TLS1.3 this becomes required. + +JH/40 Fix the feature-cache refresh for EXPERIMENTAL_PIPE_CONNECT. Previously + it only wrote the new authenticators, resulting in a lack of tracking of + peer changes of ESMTP extensions until the next cache flush. + +JH/41 Fix the loop reading a message header line to check for integer overflow, + and more-often against header_maxsize. Previously a crafted message could + induce a crash of the recive process; now the message is cleanly rejected. + +JH/42 Bug 2366: Fix the behaviour of the dkim_verify_signers option. It had + been totally disabled for all of 4.91. Discovery and fix by "Mad Alex". + Exim version 4.91 ----------------- @@ -111,7 +822,7 @@ JH/11 The runtime Berkeley DB library version is now additionally output by "exim -d -bV". Previously only the compile-time version was shown. JH/12 Bug 2230: Fix cutthrough routing for nonfirst messages in an initiating - SMTP connection. Previously, when one had more receipients than the + SMTP connection. Previously, when one had more recipients than the first, an abortive onward connection was made. Move to full support for multiple onward connections in sequence, handling cutthrough connection for all multi-message initiating connections. @@ -410,7 +1121,7 @@ JH/26 Fix DKIM bug: when the pseudoheader generated for signing was exactly line, the header hash was calculated to an incorrect value thanks to the (relaxed) space the fold became. -HS/02 Fix Bug 2130: large writes from the transport subprocess where chunked +HS/02 Fix Bug 2130: large writes from the transport subprocess were chunked and confused the parent. JH/27 Fix SOCKS bug: an unitialized pointer was deref'd by the transport process @@ -6051,7 +6762,7 @@ Exim version 4.31 same list, then the first domain was re-checked, the value of $domain_data after the final check could be wrong. In particular, if the second check failed, it could be set empty. This bug probably also applied to - $localpart_data. + $local_part_data. 41. The strip_trailing_dot option was not being applied to the address given with the -f command-line option.